summaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* scanner: dup, fwd, tproxy: Move to own scopesPhil Sutter2022-03-012-7/+13
| | | | | | With these three scopes in place, keyword 'to' may be isolated. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: meta: Move to own scopePhil Sutter2022-03-012-7/+9
| | | | | | | This allows to isolate 'length' and 'protocol' keywords shared by other scopes as well. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: at: Move to own scopePhil Sutter2022-03-012-10/+14
| | | | | | | Modification of raw TCP option rule is a bit more complicated to avoid pushing tcp_hdr_option_type into the introduced scope by accident. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: nat: Move to own scopePhil Sutter2022-03-012-15/+19
| | | | | | | | | | Unify nat, masquerade and redirect statements, they widely share their syntax. Note the workaround of adding "prefix" to SCANSTATE_IP. This is required to fix for 'snat ip prefix ...' style expressions. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: policy: move to own scopePhil Sutter2022-03-012-6/+10
| | | | | | Isolate 'performance' and 'memory' keywords. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: flags: move to own scopePhil Sutter2022-03-012-20/+25
| | | | | | This isolates at least 'constant', 'dynamic' and 'all' keywords. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: reject: Move to own scopePhil Sutter2022-03-012-4/+8
| | | | | | Two more keywords isolated. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: import, export: Move to own scopesPhil Sutter2022-03-012-7/+13
| | | | | | | In theory, one could use a common scope for both import and export commands, their parameters are identical. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: reset: move to own ScopePhil Sutter2022-03-012-6/+10
| | | | | | Isolate two more keywords shared with list command. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: monitor: Move to own ScopePhil Sutter2022-03-012-7/+13
| | | | | | Some keywords are shared with list command. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: rt: Extend scope over rt0, rt2 and srhPhil Sutter2022-03-012-9/+9
| | | | | | | These are technically all just routing headers with different types, so unify them under the same scope. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: type: Move to own scopePhil Sutter2022-03-012-36/+44
| | | | | | As a side-effect, this fixes for use of 'classid' as set data type. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: dst, frag, hbh, mh: Move to own scopesPhil Sutter2022-03-012-19/+37
| | | | | | | These are the remaining IPv6 extension header expressions, only rt expression was scoped already. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: ah, esp: Move to own scopesPhil Sutter2022-03-012-8/+14
| | | | | | They share 'sequence' keyword with icmp and tcp expressions. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: osf: Move to own scopePhil Sutter2022-03-012-6/+12
| | | | | | It shares two keywords with PARSER_SC_IP. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: dccp, th: Move to own scopesPhil Sutter2022-03-012-8/+16
| | | | | | | With them in place, heavily shared keywords 'sport' and 'dport' may be isolated. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: udp{,lite}: Move to own scopePhil Sutter2022-03-012-7/+14
| | | | | | | All used keywords are shared with others, so no separation for now apart from 'csumcov' which was actually missing from scanner.l. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: comp: Move to own scope.Phil Sutter2022-03-012-4/+8
| | | | | | Isolates only 'cpi' keyword for now. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: synproxy: Move to own scopePhil Sutter2022-03-012-14/+21
| | | | | | Quite a few keywords are shared with PARSER_SC_TCP. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: tcp: Move to own scopePhil Sutter2022-03-012-26/+36
| | | | | | | Apart from header fields, this isolates TCP option types and fields, too. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: igmp: Move to own scopePhil Sutter2022-03-012-4/+9
| | | | | | | At least isolates 'mrt' and 'group' keywords, the latter is shared with log statement. Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: icmp{,v6}: Move to own scopePhil Sutter2022-03-012-14/+18
| | | | | | Unify the two, header fields are almost identical. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: add tcp option reset supportFlorian Westphal2022-02-287-1/+84
| | | | | | | This allows to replace a tcp option with nops, similar to the TCPOPTSTRIP feature of iptables. Signed-off-by: Florian Westphal <fw@strlen.de>
* build: explicitly pass --version-script to linkerSam James2022-02-251-1/+1
| | | | | | | | | | | | --version-script is a linker option, so let's use -Wl, so that libtool handles it properly. It seems like the previous method gets silently ignored with GNU libtool in some cases(?) and downstream in Gentoo, we had to apply this change to make the build work with slibtool anyway. But it's indeed correct in any case, so let's swap. Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables.map: export new nft_ctx_{get,set}_optimize APISam James2022-02-251-2/+2
| | | | | | | | | | | | | | | | [ Remove incorrect symbol names were exported via .map file ] Without this, we're not explicitly saying this is part of the public API. This new API was added in 1.0.2 and is used by e.g. the main nft binary. Noticed when fixing the version-script option (separate patch) which picked up this problem when .map was missing symbols (related to when symbol visibility options get set). Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* scanner: rt: Move seg-left keyword into scopePhil Sutter2022-02-201-1/+1
| | | | | | | It's not used outside of rt_hdr_expr, so move it out of INIT scope. Fixes: 8861db1b771a6 ("scanner: rt: move to own scope") Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Some time units are only used in limit scopePhil Sutter2022-02-201-3/+5
| | | | | | | | 'hour' and 'day' are allowed as unqualified meta expressions, so leave them alone. Fixes: eae2525685252 ("scanner: limit: move to own scope") Signed-off-by: Phil Sutter <phil@nwl.cc>
* scanner: Move 'maps' keyword into list cmd scopePhil Sutter2022-02-201-1/+1
| | | | | | | | This was missed when introducing SCANSTATE_CMD_LIST, no other command operates on "maps". Fixes: 6a24ffb04642e ("scanner: add list cmd parser scope") Signed-off-by: Phil Sutter <phil@nwl.cc>
* segtree: memleak get element commandPablo Neira Ayuso2022-02-171-0/+2
| | | | | | | | | Release removed interval expressions before get_set_interval_find() fails. The memleak can be triggered through: testcases/sets/0034get_element_0 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: check key is EXPR_CONCAT before accessing fieldPablo Neira Ayuso2022-02-171-1/+2
| | | | | | | alloc_nftnl_setelem() needs to check for EXPR_CONCAT before accessing field_count. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_json: permit empty device listFlorian Westphal2022-02-071-10/+13
| | | | | | | | | | | Normal input parser allows flowtables without 'devices' token, which makes the json export part elide 'dev' entirely, this then breaks on re-import: $ nft -j -f json.dump /tmp/json_1:1:14-14: Error: Object item not found: dev Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_json: fix flowtable device datatypeFlorian Westphal2022-02-071-2/+6
| | | | | | | Failed with: BUG: invalid expresion type symbol Fixes: 78bbe7f7a55be489 ("mnl: do not use expr->identifier to fetch device name") Signed-off-by: Florian Westphal <fw@strlen.de>
* json: add flow statement json export + parserFlorian Westphal2022-02-073-0/+31
| | | | | | | | | | | flow statement has no export, its shown as: ".. }, "flow add @ft" ] } }" With this patch: ".. }, {"flow": {"op": "add", "flowtable": "@ft"}}]}}" Signed-off-by: Florian Westphal <fw@strlen.de>
* iface: handle EINTR case when creating the cachePablo Neira Ayuso2022-01-281-12/+38
| | | | | | | | | | If interface netlink dump is interrupted, then retry. Before this patch, the netlink socket is reopened to drop stale dump messages, instead empty the netlink queue and retry. Reviewed-by: Eugene Crosser <crosser@average.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: do not merge raw payload expressionsPablo Neira Ayuso2022-01-261-0/+3
| | | | | | | | | | | Merging raw expressions results in a valid concatenation which throws: Error: can not use variable sized data types (integer) in concat expressions Disable merging raw expressions until this is supported by skipping raw expressions. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: check for payload base and offset when searching for mergersPablo Neira Ayuso2022-01-261-0/+4
| | | | | | Extend the existing checks to cover the payload base and offset. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: merge verdict maps with same lookup keyPablo Neira Ayuso2022-01-261-12/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge two consecutive verdict maps with the same lookup key. For instance, merge the following: table inet x { chain filter_in_tcp { tcp dport vmap { 80 : accept, 81 : accept, 443 : accept, 931 : accept, 5001 : accept, 5201 : accept, } tcp dport vmap { 6800-6999 : accept, 33434-33499 : accept, } } } into: table inet x { chain filter_in_tcp { tcp dport vmap { 80 : accept, 81 : accept, 443 : accept, 931 : accept, 5001 : accept, 5201 : accept, 6800-6999 : accept, 33434-33499 : accept, } } } This patch updates statement comparison routine to inspect the verdict expression type to detect possible merger. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: add __expr_cmp()Pablo Neira Ayuso2022-01-261-46/+52
| | | | | | Add helper function to compare expression to allow for reuse. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink: Use abort() in case of netlink_abi_errorEugene Crosser2022-01-261-1/+1
| | | | | | | | | | Library functions should not use exit(), application that uses the library may contain error handling path, that cannot be executed if library functions calls exit(). For truly fatal errors, using abort() is more acceptable than exit(). Signed-off-by: Eugene Crosser <crosser@average.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: missing synproxy support in map declarationsPablo Neira Ayuso2022-01-191-0/+1
| | | | | | | Update parser to allow for maps with synproxy. Fixes: f44ab88b1088 ("src: add synproxy stateful object support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: store more than one payload dependencyJeremy Sowden2022-01-152-24/+39
| | | | | | | | Change the payload-dependency context to store a dependency for every protocol layer. This allows us to eliminate more redundant protocol expressions. Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add a helper that returns a payload dependency for a particular baseJeremy Sowden2022-01-152-6/+29
| | | | | | | | | | | Currently, with only one base and dependency stored this is superfluous, but it will become more useful when the next commit adds support for storing a payload for every base. Remove redundant `ctx->pbase` check. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: silence compiler warningsFlorian Westphal2022-01-153-4/+4
| | | | | | | | | | | | cache.c:504:22: warning: ‘chain’ may be used uninitialized in this function [-Wmaybe-uninitialized] cache.c:504:22: warning: ‘table’ may be used uninitialized in this function [-Wmaybe-uninitialized] erec.c:128:16: warning: ‘line’ may be used uninitialized in this function [-Wmaybe-uninitialized] optimize.c:524:9: warning: ‘line’ may be used uninitialized in this function [-Wmaybe-uninitialized] Fixes: 8ad4056e9182 ("erec: expose print_location() and line_location()") Fixes: afbd102211dc ("src: do not use the nft_cache_filter object from mnl.c") Fixes: fb298877ece2 ("src: add ruleset optimization infrastructure") Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: use xrealloc()Pablo Neira Ayuso2022-01-151-7/+3
| | | | | | | Instead of realloc(), so process stops execution in case memory allocation fails. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: 'nft list chain' prints anonymous chains correctlyPablo Neira Ayuso2022-01-152-0/+45
| | | | | | | | | If the user is requesting a chain listing, e.g. nft list chain x y and a rule refers to an anonymous chain that cannot be found in the cache, then fetch such anonymous chain and its ruleset. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1577 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: add helper function to fill up the rule cachePablo Neira Ayuso2022-01-151-16/+25
| | | | | | | Add a helper function to dump the rules and add them to the corresponding chain. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cache: do not set error code twicePablo Neira Ayuso2022-01-151-21/+7
| | | | | | | The 'ret' variable is already set to a negative value to report an error, do not set it again to a negative value. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: do not use the nft_cache_filter object from mnl.cPablo Neira Ayuso2022-01-152-8/+13
| | | | | | Pass the table and chain strings to mnl_nft_rule_dump() instead. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: merge several selectors with different verdict into verdict mapPablo Neira Ayuso2022-01-152-3/+84
| | | | | | | | | | | | | Transform: ip saddr 1.1.1.1 ip daddr 2.2.2.2 accept ip saddr 2.2.2.2 ip daddr 3.3.3.3 drop into: ip saddr . ip daddr vmap { 1.1.1.1 . 2.2.2.2 : accept, 2.2.2.2 . 3.3.3.3 : drop } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* optimize: merge same selector with different verdict into verdict mapPablo Neira Ayuso2022-01-151-15/+147
| | | | | | | | | | | | | Transform: ct state invalid drop ct state established,related accept into: ct state vmap { established : accept, related : accept, invalid : drop } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>